FerretDB’s SQLite query optimization translated a logical OR into SQL when every branch appeared safe, but its direct dotted JSON accessor could not follow a path through the loginTokens array. It discarded the matching user before the Mongo-compatible filter ran, so HttpOnly cookie refresh returned invalid_cookie and logged the user out shortly after login. Logical OR filters with dotted paths now remain in the authoritative Go matcher, while safe scalar OR queries keep their optimized SQL path. Positive collection coverage reproduces the nested-token lookup and a negative builder test prevents the unsafe pushdown.

The shared FerretDB conformance catalogue now reproduces the nested-array query from FerretDB issue 17 instead of testing dotted paths and logical OR only in isolation. The current arm64 run built FerretDB from commit a7c9441b and ran all 103 cases on SQLite, PostgreSQL, MySQL and MariaDB. Every backend answered every case identically with no errors. SAP HANA remains the script’s explicit opt-in backend and has no arm64 image, so it could not run on this machine.